How does it work?

To create a last logon report you need to inspect Active Directory user objects. User objects have the attribute ‘lastLogon’ – the last time the user logged on. Its value is stored as a large integer that represents the number of 100-nanosecond intervals since January 1, 1601 (UTC). For example, a ‘lastLogon’ attribute value of 131358722699872122 converts to 4/5/2017 6:24:29 AM PDT.

Last Logon Format

Attribute ‘lastLogon’ is not replicated to other domain controllers, so you need to get this attribute value from all domain controllers, compare them and choose the latest value.

There is attribute ‘lastLogonTimestamp’ which is replicated, but it does not contain the precise value of the actual last logon time. ‘lastLogonTimestamp’ gets updated only if its current value is approximately 14 days older than current logon time. You can find the actual algorithm and more information in this article.

How do I create a precise last logon report?

For all users in domain

Open AD FastReporter.

From Users tab, select ‘All users’ report form.

From the available fields list, select field ‘Last Logon Time’ and add it to the selected fields list.

Fields

If necessary, remove unnecessary fields from the selected fields list.

Press generate and wait for results.

If a particular domain controller is unreachable, then there will be a warning message.

Generation Completed

Press ‘Show report in table view’. You can examine the report and, if necessary, export to a CSV, Excel (XLSX) or HTML format file.

Report Results

For specific user

Open AD FastReporter.

Select ‘Reports’ -> ‘New Report Form’.

New Report Form

Enter report form name and select Type ‘Users’.

Report Form

Press ‘Edit’ to create a custom filter. Choose the field that you want to filter and the filter operation and filter value. In this example, we will use the field ‘First Name’, filter operation – ‘equals’, and filter value – ‘Adam’.

Filter Manager

Save changes in the filter manager and save this report form. Now you can use the form to create the last logon report for the specific user.

Follow the instructions starting from the 3. point in ‘For all users in the domain’ instruction.

For specific organizational unit

Open AD FastReporter.

Open Connection manager, select your current connection and press ‘Edit’.

Filter OU

At the bottom, you will see ‘OU’ where you can specify which container to use in this connection. You can press the browse button and choose the container or enter the full name of the container you want.

Press save when you have finished and all the reports will now be created using data from this container only.

Follow instructions starting from the 2. point in ‘For all users in domain’ instruction.

If you need to create multiple reports from one domain, but from different containers, then you can create multiple connections.

Benefits

As a member of the AD FastReporter Beta Testing Program, you’ll get early access to new releases before everyone else. We’ll ask for your feedback about new features and your help discovering bugs. It doesn’t take long, but it helps us enormously.
You’ll also have the opportunity to gain a free full production license after the beta program is completed!